Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95187
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.21 as permitted sender)
To: Tony Marston <TonyMarston@hotmail.com>, internals@lists.php.net
References: <CAGa2bXarw2jTj0yhXpywWNQOJLR2pdhfaqSdwj_btT2giEL15Q@mail.gmail.com>
 <CAGa2bXadVagTwBzEym9PZROmXu3SKxg=huCAQNK3k1-jZeG_pg@mail.gmail.com>
 <CAGa2bXY-vmEgEFrE0OxQPSx=FKHeHdCayrDXxtTkHUVaJbV+-A@mail.gmail.com>
 <CA+kxMuRiOBQpmTeKqNyV8rX0GKCLrYixi--y5TcYUkdqpT746w@mail.gmail.com>
 <90.51.36656.0C0A1B75@pb1.pair.com>
Message-ID: <0cb4db8b-0130-5ba6-6954-d3132345aec3@gmx.de>
Date: Mon, 15 Aug 2016 15:13:43 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <90.51.36656.0C0A1B75@pb1.pair.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Add validation functions to filter
 module
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 15.08.2016 at 13:00, Tony Marston wrote:

> "Dan Ackroyd"  wrote in message
> news:CA+kxMuRiOBQpmTeKqNyV8rX0GKCLrYixi--y5TcYUkdqpT746w@mail.gmail.com...
>
>> "Input data validation should accept only valid and possible inputs.
>> If not, reject it and terminate program."
> 
> I DISagree 100%. Validation errors should NEVER terminate the program,
> they should continue by displaying all the error messages to the user so
> that he/she can correct his/her mistake and try the operation again.

Yasuo (who Dan quoted here) refers to completely invalid input, such as
invalid UTF-8 byte sequences.  I think, that in this case the app should
bail out without even given detailed information, as such grossly
invalid input most likely is an attempt to attack (or a severe browser bug).

-- 
Christoph M. Becker